An increasing number of consumers are using devices configured to use near-field communication (NFC) and other proximity communication protocols for payment transactions. For example, a consumer's mobile device may comprise NFC hardware and a secure element or other secure storage medium for storing sensitive account information. In order to conduct a payment transaction, the consumer may place the mobile device in proximity to a point of sale terminal, access device, or other proximity or contactless communication reader. The transaction may then be processed using secure payment information stored on the secure storage medium, without the user requiring to provide a physical credit card or manually enter a credit card number.
Consumers may also conduct online payment transactions using mobile devices. For example, a consumer may download a merchant application and select some items to purchase. Then, to conduct the payment transaction, the consumer may enter payment information using a physical or on-screen keyboard. However, the manual entry of payment information to merchant applications is often redundant, as the consumer may already have payment information stored in a secure storage medium. Further, the manual entry of payment information may introduce security risks such as a vulnerability to eavesdropping.
Accordingly, there is a need to allow a consumer to use secure payment credentials stored on a mobile device to initiate and process a remote transaction. However, the payment credentials stored on the mobile device are sensitive and the merchant applications on the mobile device may be open to hacking, spoofing, and other security threats. As such, there is a need to ensure the payment credentials stored securely on the mobile device are secured against potential malicious applications and threats on the mobile device during payment transaction processing.
Furthermore, traditional remote transactions have limited security features and a higher risk of fraud because a consumer is not present at a merchant or service provider for verification that the payment credentials have not been stolen or intercepted and are not being used by a malicious third party. Accordingly, there is a need to increase the security of remote transactions initiated from mobile devices.
Embodiments of the present invention address these problems and other problems individually and collectively.